Описание
Security update for mariadb
This mariadb version update to 10.0.29 fixes the following issues:
-
CVE-2017-3318: unspecified vulnerability affecting Error Handling (bsc#1020896)
-
CVE-2017-3317: unspecified vulnerability affecting Logging (bsc#1020894)
-
CVE-2017-3312: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 (bsc#1020873)
-
CVE-2017-3291: unrestricted mysqld_safe's ledir (bsc#1020884)
-
CVE-2017-3265: unsafe chmod/chown use in init script (bsc#1020885)
-
CVE-2017-3258: unspecified vulnerability in the DDL component (bsc#1020875)
-
CVE-2017-3257: unspecified vulnerability affecting InnoDB (bsc#1020878)
-
CVE-2017-3244: unspecified vulnerability affecing the DML component (bsc#1020877)
-
CVE-2017-3243: unspecified vulnerability affecting the Charsets component (bsc#1020891)
-
CVE-2017-3238: unspecified vulnerability affecting the Optimizer component (bsc#1020882)
-
CVE-2016-6664: Root Privilege Escalation (bsc#1008253)
-
Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428)
-
notable changes:
- XtraDB updated to 5.6.34-79.1
- TokuDB updated to 5.6.34-79.1
- Innodb updated to 5.6.35
- Performance Schema updated to 5.6.35
Release notes and changelog:
Список пакетов
SUSE Linux Enterprise Server 12-LTSS
SUSE Linux Enterprise Server for SAP Applications 12
Ссылки
- Link for SUSE-SU-2017:0411-1
- E-Mail link for SUSE-SU-2017:0411-1
- SUSE Security Ratings
- SUSE Bug 1008253
- SUSE Bug 1020868
- SUSE Bug 1020873
- SUSE Bug 1020875
- SUSE Bug 1020877
- SUSE Bug 1020878
- SUSE Bug 1020882
- SUSE Bug 1020884
- SUSE Bug 1020885
- SUSE Bug 1020891
- SUSE Bug 1020894
- SUSE Bug 1020896
- SUSE Bug 1022428
- SUSE CVE CVE-2016-6664 page
- SUSE CVE CVE-2017-3238 page
- SUSE CVE CVE-2017-3243 page
- SUSE CVE CVE-2017-3244 page
Описание
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
Затронутые продукты
Ссылки
- CVE-2016-6664
- SUSE Bug 1008253
- SUSE Bug 1020868
- SUSE Bug 1020873
- SUSE Bug 998309
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3238
- SUSE Bug 1020868
- SUSE Bug 1020882
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets). Supported versions that are affected are 5.5.53 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 4.4 (Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3243
- SUSE Bug 1020868
- SUSE Bug 1020891
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3244
- SUSE Bug 1020868
- SUSE Bug 1020877
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.34 and earlier5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3257
- SUSE Bug 1020868
- SUSE Bug 1020878
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3258
- SUSE Bug 1020868
- SUSE Bug 1020875
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 5.6 (Confidentiality and Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3265
- SUSE Bug 1020868
- SUSE Bug 1020885
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3291
- SUSE Bug 1020868
- SUSE Bug 1020884
- SUSE Bug 998309
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3312
- SUSE Bug 1020868
- SUSE Bug 1020873
- SUSE Bug 998309
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 4.0 (Availability impacts).
Затронутые продукты
Ссылки
- CVE-2017-3317
- SUSE Bug 1020868
- SUSE Bug 1020894
Описание
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.0 (Confidentiality impacts).
Затронутые продукты
Ссылки
- CVE-2017-3318
- SUSE Bug 1020868
- SUSE Bug 1020896